Make the strict Spring annotation-source regression portable

[malik111110]

Outcome

The strict Spring real-repository test proves annotation-derived input reaches the intended taint rules in a reproducible public fixture.

Maintainer guidance

TestSpringAnnotationSources_TaintRulesFire in internal/integration/realrepo_test.go is currently skipped pending source modeling. Preserve the smoke test while making the strict assertion portable. Do not rely on a maintainer-specific absolute path.

Acceptance criteria

• Document the public repository and immutable revision used as evidence.
• Add a fetch script, compact checked-in fixture, or deterministic test setup with license/attribution.
• Model the required Spring annotation source without widening unrelated Java sources.
• Unskip the strict test and assert the intended PF-SPRING rule IDs.
• Add a negative/normal case showing no broad false-positive regression.
• go test ./internal/sast/frameworks/spring ./internal/sast/taintpatterns -count=1 passes.
• The targeted integration test passes from a clean checkout within a documented timeout.
• Record before/after finding counts and any noise tradeoff.

Review boundary

A maintainer must review source-model breadth, fixture licensing, and false-positive evidence before merge. Refs #7.